Privacy Policy

1. Who We Are

Veltrix Pvt Ltd ("Veltrix", "we", "us") is the data controller responsible for personal data processed through the BAREC platform. We are incorporated under the laws of the Republic of Mauritius.

BAREC is a business management SaaS platform used by organisations to manage their sales, inventory, employees, customers, and financial operations.

Data Protection contact: [email protected]

2. What Data We Collect

2.1 Account and Organisation Data

• Full name, email address, and username of account holders and employees
• Organisation name, address, and branch details
• Role and access level within your organisation
• Account creation date and last login time

2.2 Business Operations Data

• Sales transactions, product details, and pricing records
• Inventory and stock levels per branch
• Customer records including name, contact information, and purchase history
• Expense records and financial statements
• Acquisition and dispatch records

2.3 Communications Data

• Internal messages sent between employees via the BAREC chat feature
• Broadcast announcements sent to staff

2.4 Technical Data

• Session data and authentication tokens
• IP address and browser type (for security logging)
• Usage logs and error reports to improve platform stability

2.5 Data We Do Not Collect

We do not collect payment card details (payments are processed via third-party providers). We do not collect biometric data, government ID numbers, or sensitive personal data as defined under the Mauritius DPA 2017 unless explicitly required and consented to.

3. How We Use Your Data

We use the data we collect to:

• Provide the Service: Operate, maintain, and improve the BAREC platform and its features
• Account Management: Create and manage user accounts, authenticate logins, and maintain session security
• Business Operations: Enable you to manage sales, inventory, employees, customers, and finances within your organisation
• Communications: Send service-related notifications, security alerts, and support responses
• Analytics: Aggregate and anonymised usage analysis to improve the platform (no individual profiling)
• Legal Compliance: Comply with applicable laws, respond to lawful requests, and enforce our Terms & Conditions
• Security: Detect, investigate, and prevent fraud, abuse, and security incidents

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Legal Basis for Processing

Under the Mauritius Data Protection Act 2017, we process your personal data on the following legal bases:

• Contractual necessity: Processing is necessary to provide the BAREC service you have subscribed to
• Legitimate interests: To improve our platform, ensure security, and prevent fraud — where these interests are not overridden by your rights
• Legal obligation: Where processing is required to comply with applicable laws
• Consent: Where you have given specific, informed consent for processing (e.g., marketing communications). You may withdraw consent at any time.

5. Data Sharing and Third Parties

We may share your data with:

• Hosting and Infrastructure Providers: Cloud server providers used to host the BAREC platform (subject to data processing agreements)
• Technical Support Partners: Third parties who assist in maintaining or improving the platform, under strict confidentiality obligations
• Legal Authorities: Law enforcement or regulatory bodies where we are legally required to disclose information

We require all third-party processors to implement appropriate security measures and to process data only as instructed by Veltrix.

We will never sell your data to advertisers, data brokers, or any commercial third parties.

6. Data Retention

We retain personal data only for as long as necessary for the purposes outlined in this policy:

• Active accounts: Data is retained for the duration of your subscription
• After termination: Data is retained for up to 30 days to allow for data export, then permanently deleted
• Financial records: Transaction and financial records may be retained for up to 7 years where required by law
• Security logs: Access and security logs are retained for up to 90 days

You may request earlier deletion of your data where it is not required for legal compliance. See Section 9 for your rights.

7. Data Security

We implement the following security measures to protect your data:

• HTTPS/TLS encryption for all data in transit
• Secure password hashing using industry-standard algorithms
• Role-based access controls limiting data access to authorised users
• Automatic session timeout after periods of inactivity
• Regular backups to prevent data loss

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Mauritius Data Protection Commissioner within 72 hours of discovery, and notify affected individuals without undue delay, in accordance with the Data Protection Act 2017.

8. International Data Transfers

Your data may be stored or processed on servers located outside the Republic of Mauritius. Where data is transferred internationally, we ensure appropriate safeguards are in place, including:

• Data processing agreements with hosting providers that include standard contractual clauses
• Transfer to countries with adequate data protection laws as recognised by Mauritius

By using BAREC, you acknowledge and consent to the transfer of your data as described.

9. Your Rights Under the Mauritius DPA 2017

As a data subject under the Mauritius Data Protection Act 2017, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements
• Right to Restriction: Request that we limit the processing of your data in certain circumstances
• Right to Object: Object to processing based on legitimate interests
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Withdraw Consent: Withdraw consent for processing where consent is the legal basis

To exercise any of these rights, contact us at [email protected]. We will respond within 28 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commissioner of Mauritius.

10. Cookies and Session Tracking

BAREC uses session cookies solely to maintain your authenticated login session. These cookies are:

• Session cookies: Expire when you close your browser or after 30 minutes of inactivity
• Strictly necessary: Required for the platform to function — no optional tracking or advertising cookies are used

We do not use third-party analytics cookies, advertising trackers, or social media pixels within the authenticated application.

11. Children's Privacy

BAREC is a business management platform intended exclusively for use by organisations and their adult employees. We do not knowingly collect personal data from individuals under the age of 18. If you become aware that a minor has provided us with personal data, please contact us at [email protected] and we will take steps to delete such data promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notification at least 14 days before the changes take effect and update the "Last updated" date at the top of this page.

Your continued use of BAREC after the effective date of the updated policy constitutes your acceptance of the changes.

13. Contact Us and Complaints

For any privacy-related queries, requests, or complaints:

• Company: Veltrix Pvt Ltd
• Privacy email: [email protected]
• General enquiries: [email protected]
• Jurisdiction: Republic of Mauritius

If you are not satisfied with our response, you may contact the Data Protection Commissioner of Mauritius:

• Website: dataprotection.govmu.org
• Address: Level 3, Celicourt Antelme Street, Port Louis, Mauritius